Most recent entries from all

CVE-2026-48710 — Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

2026-09-29T16:53:30.262544+00:00

Affected: Kludex starlette, Red Hat AI Inference Server 3.3, Red Hat Ansible Automation Platform 2.6, Red Hat Ansible Automation Platform 2.7, Red Hat Migration Toolkit for Applications 8.2, Red Hat OpenShift AI 3.3, Red Hat OpenShift AI 3.4, Red Hat Satellite 6.17, Red Hat Satellite 6.18, Red Hat Satellite 6.19 and 6 more

Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.

GHSA-86qp-5c8j-p5mr — Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

2026-09-29T16:53:30.262808+00:00

Affected: PyPI: starlette

### Summary In affected versions, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed.

### Details When a client requests `http://example.com/foo`, it sends:

```http GET /foo HTTP/1.1 Host: example.com ```

Affected versions reconstructed the URL by concatenating `http://{host}{path}` and re-parsing the result. The `Host` value is only valid as a `uri-host [ ":" port ]` per [RFC 9112 §3.2](https://www.rfc-editor.org/rfc/rfc9112.html#section-3.2-6), where `uri-host` follows the restricted `host` grammar of [RFC 3986 §3.2.2](https://www.rfc-editor.org/rfc/rfc3986.html#section-3.2.2). When it contains characters outside that grammar - notably `/`, `?`, or `#` - those characters move the path/query/fragment boundaries during re-parsing, so the parsed `request.url.path` no longer matches the path the server actually received. For example:

```http GET /foo HTTP/1.1 Host: example.com/abc?bar= ```

reconstructs to `http://example.com/abc?bar=/foo`, whose parsed `path` is `/abc` - even though routing used the real path `/foo`. The router still dispatches to `/foo` and the endpoint execut…

PYSEC-2026-161 — BadHost: Missing Host header validation poisons request.url.path, bypassing path-based security checks

2026-09-29T16:53:30.262910+00:00

Affected: PyPI: starlette

Starlette reconstructs the requested URL based on the HTTP Host request header and requested path, but does not perform any validation of the Host header value. This allows attackers to inject paths into the host part, prepending the actual path. However, routing in Starlette is based on the actual request path. This inconsistent interpretation of HTTP requests may lead to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path.